Proton Mail Helped FBI Unmask Anonymous 'Stop Cop City' Protester (404media.co) 59
Longtime Slashdot reader AmiMoJo shares a report from 404 Media: Privacy-focused email provider Proton Mail provided Swiss authorities with payment data that the FBI then used to determine who was allegedly behind an anonymous account affiliated with the Stop Cop City movement in Atlanta, according to a court record reviewed by 404 Media. The records provide insight into the sort of data that Proton Mail, which prides itself both on its end-to-end encryption and that it is only governed by Swiss privacy law, can and does provide to third parties. In this case, the Proton Mail account was affiliated with the Defend the Atlanta Forest (DTAF) group and Stop Cop City movement in Atlanta, which authorities were investigating for their connection to arson, vandalism and doxing. Broadly, members were protesting the building of a large police training center next to the Intrenchment Creek Park in Atlanta, and actions also included camping in the forest and lawsuits. Charges against more than 60 people have since been dropped.
welp (Score:5, Informative)
I tried to switch to Proton a while ago and nearly loss access to everything because the way they use yubikeys doesn't work how I expected. Feel like I dodged a bullet. Self-host everything you can, no point in this cloud bullshit when there's syncthing.
Re: welp (Score:3, Insightful)
This isn't a protonmail problem, and self-hosting will make you even more vulnerable to this. Whoever is paying the bill for hosting is where the money trail begins.
Re: (Score:1)
Pay for your hosting fees through some shell companies you create, ideally add the name Trump to one of them.
Re: (Score:2)
Re: (Score:2)
It was definitely a protonmail problem. It changed one of my yubikey credentials because its default behavior isn't clearly explained.
Re: (Score:2)
Also "self-hosting" can mean you do it at home. A home server isn't expensive, and you don't even need to really set one up if you don't mind putting the stuff you need synced on your phone.
Re: welp (Score:3)
Re: (Score:3)
Under the present circumstances, if the state wants you the state will get you. They do not and have never needed anything real. The purpose of doing this is so people can't just casually make a buck off your data or cut off your access to it due to a policy change.
Re: (Score:2)
Re: (Score:2)
https://en.wikipedia.org/wiki/... [wikipedia.org]
They know all... any IP traffic, phone traffic, including encrypted stuff runs through there and gets scanned for keywords.
Re: (Score:2)
Re: welp (Score:1)
They pierced Proton Mail's privacy my following the money trail.
Self-hosting your mail server has two money trails - the ISP bill and the domain registration fee.
Oh shut up (Score:5, Interesting)
This isn't news. Remember how it was reported the last time it happened?
https://www.thedailybeast.com/... [thedailybeast.com]
Proton mail has never, despite what is being claimed, promised to not store your IP address. A subpeona can compel them to do so, and it has in the past, and this will continue to happen. If your security depends on your IP address not being unmasked, you need to use at least one VPN.
If you self hosted then the subpeona would be delivered to your ISP, which will happily comply- likely quicker than protonmail.
NO EMAIL SERVICE WILL COMMIT A CRIME FOR YOU
If you only connect through VPNs, then the email service will provide the VPN's IP. If the VPN is then contacted and they have no logs, then they will not be able to correlate the IP to a user. This is your only chance at anonymity under these circumstances: some VPN plus some private mail service that never knows your real IP address. Note that proton is a strong choice here because if you previously connected via your real IP they won't have a log of that; they'll only start saving your IP when they get a warrant. There are other equally strong private email choices, but ALL OF THEM WILL DELIVER YOUR IP IF THEY KNOW IT.
Re: Oh shut up (Score:2)
You can identified even if you use a vpn. For example, letâ(TM)s say youâ(TM)re known to subscribe to Service X. You are also known to subscribe to VPN X. Law enforcement can determine that an ip address connected to VPN X and at a specific time and that VPN ip also connected to service X. That could be enough to convince a jury that youâ(TM)re guilty of a crime
Re: (Score:2)
You can identified even if you use a vpn. For example, letâ(TM)s say youâ(TM)re known to subscribe to Service X. You are also known to subscribe to VPN X. Law enforcement can determine that an ip address connected to VPN X and at a specific time and that VPN ip also connected to service X. That could be enough to convince a jury that youâ(TM)re guilty of a crime
Which in why, in such a case, it is important to get someone who is relatively tech savvy to help explain why that is not conclusive. Of course, having such a person in the pool is hit or miss.
Re: (Score:2)
Re: (Score:2)
despite what is being claimed, promised to not store your IP address.
And yet... 2.5 IP logging: By default, we do not keep permanent IP logs in relation with your Account. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our Terms of Service (e.g. spamming, DDoS attacks against our infrastructure, brute force attacks). The legal basis of this processing is our legitimate interest to protect our service against non-compliant or fraudulent activities. If you enable a
Re: (Score:2)
Wait a second, so the pretense was they are "which authorities were investigating for their connection to arson, vandalism and doxing"
And the charges were dropped meaning they had done none of these things at all not even a little bit of connection (or they would have prosecuted). And we are looking at proton mail or self hosting or paying for the site as the issue?
Have we really started missing the real issue?
There's nothing surprising about this (Score:5, Informative)
Proton mail has strong privacy policy, privacy protection and minimal data retention. But if money changes hands some data is essentially retained as it is legally required. Any data retained is subject to discovery by a court order.
This doesn't in any way minimise Proton Mail's offering or promises. It's worth remembering they are privacy focused, and not a dedicated service to obfuscate you. There's a different.
Re:There's nothing surprising about this (Score:5, Informative)
Re: (Score:3)
Re:No the right tool for the job (Score:4, Informative)
Perhaps, but it also means that Proton mail does not protect me from my overreaching anti-speech government.
That's correct, and it's not their mission. When I was looking into Proton mail a few years ago, they were promising privacy against tracking by corporations, not anonymity from government investigation. They were positioning their services as an alternative to Google's & Microsoft's data gathering. There is a free tier, so some people might be able to successfully use it for fully covert communications, but that's not what interested me in it.
Re: (Score:2)
And it never pretended it did. If you thought it was the kind of service that operated in a way that ignores legal discovery then that is on you, not them.
Re: There's nothing surprising about this (Score:2)
Exactly, what this means isn't that their policies have changed, it means it's still insensible to give them money believing they will protect your privacy. In fact it will have the opposite effect.
Re: There's nothing surprising about this (Score:4, Informative)
Welll... they'll protect you privacy, but not your identity. They didn't divulge what the messages said, just who paid the bills.
Re: (Score:2)
Except you're conflating "protecting your privacy" with "illegally obfuscating you". That is precisely the point you missed. There is no legal financial transaction you can conduct that does the latter as every legal entity is governed by laws of the land and the courts therein.
Conflating privacy and hiding you from courts is equal parts ignorant and dangerous. Proton Mail absolutely do protect your privacy.
Re: (Score:2)
There are times when nothing but hiding you from courts would protect your privacy. To be clear, I do not expect them to be able to do that. But it does still mean that giving them money is contrary to having maximum privacy, as it would be if you gave anyone else money.
Bad headline (Score:5, Informative)
Proton Mail didn't help the FBI.
Proton Mail acted in response to a lawful request made by Swiss authorities.
Those authorities helped the FBI.
Re: (Score:1)
If Proton Mail were really so "privacy focused", then they should not keep payment data, such as credit card numbers.
Re: (Score:1)
How would they take recurring payment of their subscription-based service if they don't keep the payment data?
No, the better solution is for them to be located on the moon, so that they don't get subject to earthly governments' laws.
Scratch that, some people/government have plans for moon bases, they should move to Alpha Centauri.
Re: (Score:2)
I use Mullvad and they accept crypto payments.
Re: (Score:3)
Re: (Score:2)
So if you paid with shitcoin, you would have to load your wallet somehow, and that would be thru an exchange, right? Then the exchange would have your payment info and your wallet address because of KYC requirements... so then that data would be subject to discovery by "authorized" law agencies... right? So then the dots still lead back to you
I think the issue is, is it possible to load a privately generated wallet without that chain of custody?
I'm all ears.
Re: (Score:3)
Re: (Score:2)
I know that crypto/blockchain is public domain information..
It is possible to create a wallet that isn't done thru an exchange. but... is it possible to load a wallet without going thru an exchange?
Re: (Score:1)
Why wouldn't it be? Mine the bitcoin yourself, or use a visa giftcard that you buy with cash, or put cash into a bitcoin atm.
I don't know, maybe it's more difficult to do this now - I stopped mining/getting new bitcoin a few of years ago as it became not financially worth it - but I still have some that never went through anything that has a payment method that can be traced back to me.
Re: (Score:2)
I wonder if they discourage recurring billing for that reason?
Alpha Centuri (Score:1)
Re: Bad headline (Score:1)
The problem with credit cards is fraud and chargebacks. They'd be stupid not to retain that for three months at the very least but ideally at least a year. That's a total no-go for people paying monthly.
So how do they bill customers?
I mean there's cash, but good luck with that, and it's no guarantee of anything. Crypto could work if they didn't keep records of which transactions went to which account. Especially if it's a hard to trace crypto like monero.
But still, none of this is any guarantee. If you insi
Re:Bad headline (Score:4, Interesting)
"Privacy focused" means they don't routinely, automatically scan your emails and blast what it infers from them to anyone with $2 to spend. That is, unfortunately, the baseline to compare with.
Re: (Score:1)
What exactly was lawful about the request from the Swiss authorities? There was no evidence that a violation of Swiss laws was being committed on Swiss soil.
Re: (Score:2)
Re: (Score:3)
I don't think it'll be much longer before the whole world realizes they're lying, and refuse to cooperate.
That will, unfortunately, impede catching real criminals. That's what happens when you put criminals in charge, one way or another.
Re: Bad headline (Score:2)
A big powerful country showed up and demanded the information. Remember when that same country broke Swiss banking privacy? Whine all you like about rules. They are only as strong as the parties that can enforce them.
Yes, courts can unmask people (Score:1)
Judicial system's job is to regulate these things. Here you have clear cut criminal activity, almost certainly a search warrant issued by the court, followed by a legal request to a foreign entity with similar laws, where their legal system evaluates the request, concludes that yes criminality of this sort has applicable laws in Switzerland and request is otherwise valid and request relevant information from a company running under their legal system.
Where's the problem?
Re: Yes, courts can unmask people (Score:5, Interesting)
It is just to unmask and intimidate a protestor who doesnâ(TM)t want a bunch of cops getting funding.
I e. True enemy of the state who needs investigation, fund freezing, and more intimidation of course.
There was no arson you twat.
Re: (Score:2)
Straight from the OP:
>"which authorities were investigating for their connection to arson, vandalism and doxing"
Courts grant wide ranging search warrants for much less than that. Especially when you're looking for organizers trying to do those things at scale. This is true for basically all nations within Western jurisprudence (with exception of France, where investigative Magistrate himself may show up at your door, and he and his people won't be nice about it).
Re: (Score:3)
Re:Yes, courts can unmask people (Score:4, Informative)
> Here you have clear cut criminal activity
I'm not seeing any mentioned in the article or summary. Protesting isn't supposed to be illegal in the US, even if the American police and conservatives-when-its-liberals-protesting often treat it as if it is.
Re: (Score:2)
It's a good thing they're not investigating protesting, but, and I quote:
"which authorities were investigating for their connection to arson, vandalism and doxing."
"Your honor, I did try to burn down the building with people in it, but it was just protesting" goes even worse in court than "your honor, I did invade Capitol building without permission to enter".
Re: (Score:2)
Re: (Score:2)
My gasts have been flabbered. (Score:1)
I would never have expected the "neutral" Swiss to cooperate with a fascist government in punishing a civilian population! They've never done that before or have a well documented history of that behavior. I'm shocked.
Use Threma instead (Score:2)
They make very sure to now even have your data.